The EVM bytecode (compiled form) is available/observable to all users at all times.
The data in contract states, including variables explicitly marked
private, is available/observable to all users at all times.
private describes visibility to other contracts but it is a misunderstanding to assume it implies protection for confidential information.
bytecode is close to the metal and challenging to interpret from a human perspective. Most contract authors publish the source code publicly, so humans can see what the contract does. The code is commonly published on Etherscan's website. They compile the submitted source code and compare to the live
bytecode. If it matches, then the contract address receives the "verified" stamp and they host a copy of the source code. This is optional and outside the scope of the actual EVM.
Hope it helps.